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Abstract — We propose a wide class of distillation schemes for 
multi-partite entangled states that are CSS-states. Our proposal 
provides not only superior efficiency, but also new insights on 
the connection between CSS-states and bipartite graph states. 
We then consider the applications of our distillation schemes for 
two cryptographic tasks — namely, (a) conference key agreement 
and (b) quantum sharing of classical secrets. In particular, we 
construct "prepare-and-measure" protocols. Also we study the 
yield of those protocols and the threshold value of the fidelity 
above which the protocols can function securely. Surprisingly, 
our protocols will function securely even when the initial state 
does not violate the standard Bell-inequalities for GHZ states. 
Experimental realization involving only W-partite entanglement 
is also suggested. 

I. Introduction 

Entanglement is the hallmark of quantum mechanics and has 
become the most important resources for various quantum in- 
formation tasks nowadays. For practical aims, one may at first 
sight ask, how many standard states (e.g., Einstein-Podolsky- 
Rosen (EPR) states and Greenberger-Horne-Zeilinger (GHZ) 
states) can be distilled through a noisy channel [1]. While 
this problem is really hard to work out, except for the case 
of bipartite pure state, because one has to consider all the 
possible strategy for entanglement distillation (for a recent 
review, see [2]). A practical way is to study specific strate- 
gies for entanglement distillation. While the classification of 
bipartite pure-state entanglement has been solved, currently 
the classification of multi-partite entanglement and mixed 
state bipartite entanglement is an important open problem 
[2], Our focus on this paper is to study the distillation 
of mM/f/-partite entanglement and its applications to multi- 
party quantum cryptography. Our motivations is threefold: 
theoretically for better understanding and quantifying multi- 
partite entanglement; practically to propose new applications 
of quantum cryptography in the multi-party setting particularly 
in the presence of noises; and finally to provide a bridge 
between theory and practice. 

For convenience, we use the standard stabilizer formulation, 
particularly specialize to the case where the output state is a 
so-called Calderbank-Shor Steane (CSS) state [3], [4], which 
is a simultaneous eigenstate of a complete set of (commuting) 
stabilizer generators each of either X-type or Z-type. We note 
that CSS states are equivalent to bipartite graph codes, which 
have previously been analyzed by Diir, Aschauer and Briegel 



[5]. We remark that one part of this equivalence — that CSS 
states are bipartite graph states — was due to Eric Rains [6], 
Our observation puts the earlier work of [5] in the more 
systematic setting of CSS formulation. Moreover, we apply 
the idea of CSS-state distillation to the construction of multi- 
party quantum cryptographic protocols. 

We specifically consider two multi-party cryptographic 
tasks, namely (a) conference key agreement where three par- 
ties, Alice, Bob, and Charlie, would like to obtain a common 
random string of number, known as the conference key, k, 
and to ensure that k is secure from any eavesdropper, Eve; 
and (b) quantum sharing of classical secrets [7] where Alice 
would like to divide up her secret password between two 
parties, B' and C, in such a way that neither B' nor C 
alone knows anything about the password and yet when B' 
and C come together, they can re-generate the password. To 
secure the classical communications between the parties in 
both protocols, we assume that each pair of the three parties 
are authenticated by standard unconditionally secure method 
of authentication. 

For practical interest, we will construct "prepare-and- 
measure" type protocols for both quantum cryptography tasks, 
for which the participants do not need to have full-blown 
quantum computers to implement them. In such protocols, 
there is a preparer who prepares some number, say N, copies 
of a standard entangled multi-partite state and distributes them 
to other participants. Each of other participants just performs 
some local individual measurement on his/her share of each 
copy of the state. The participants then perform classical post- 
processing (i.e., classical computations and classical commu- 
nications (CCCCs) that can be performed by strictly classical 
devices). Our study is a natural generalization of the security 
proofs by Shor-Preskill [8] and Gottesman-Lo [9] of the BB84 
[10] quantum key distribution protocol to the multi -partite 
case. [The first proof of security of BB84 was by Mayers 
[11].] 

Our paper is organized as follows. In Section 2, we study 
the entanglement distillation of the GHZ state and present an 
improved hashing protocol. It can distill prefect GHZ state 
successfully whenever the fidelity F > 0.7554 comparing 
the result of F > 0.8075 in [12] for a tripartite Werner- 
like state. In Section 3, we generalize our results from the 
GHZ state to a general so-called CSS state and show that the 



various subroutines that we have studied, in fact, apply to a 
general CSS state. Also we show the equivalence of CSS states 
and bipartite graph states. In Sections 4 & 5, we apply our 
formulation to study the three-party conference key agreement 
and secret sharing problem, and show that for tripartite Werner 
state, conference key agreement is possible whenever the 
fidelity F > 0.3976, while for secret sharing whenever fidelity 
F > 0.5372. We remarked that our protocols, will work even 
when the initial GHZ-state does not violate standard Bell 
inequalities. 

II. Distillation of the GHZ state 

Suppose three distant parties, Alice, Bob, and Charlie, share 
a GHZ state \V) ABC = -J-(|0) |0) |0) + |1) |1) |1>, which 
is the +1 eigenstate of commuting observables (stabilizer 
generators): So = X®X®X, Si = Z®Z®I S 2 = Z®I®Z, 

--*-(! ;> y -(? 

denote a GHZ basis as following: 

\*pmm)abc = -^(1°) l J 2> + (-!) P I 1 ) F) R > (D 

where p and the i's are zero or one and a bar over a 
bit value indicates its logical negation. Here, (p, 11,12) 
correspond to the eigenvalues of the 3 stabilizer generators 
So,Si,S2 by correspondence relation: eigenvalue 1 — > 
label 0, and eigenvalue —1 — > label 1. Thus, a density 
matrix which is diagonal in the GHZ-basis would be: 

Pabc =diagonal{p oo, Pioo, Poll > Pm> Poio, Piio, Pooi , Pioi}- 
We can think of an GHZ-state to be in one of the eight 
possible basis states. 

A. Error rate estimation and derivation of density matrix 
(GHZ-basis diagonal) 

Suppose three parties share a general tri-partite density 
matrix that is not necessarily diagonal in the GHZ-basis. But 
according to [13], [14], one can depolarize a general 3-party 
density matrix by applying with the operator XXX, followed 
by ZZI and finally, ZIZ with a probability 1/2 separately. 
The overall operation makes p diagonal in the basis Eq. Q 
without changing the diagonal coefficients. For this reason, we 
will focus only on the diagonal elements of a density matrix 
in the GHZ-basis. 

In this paper, we often assume the three parties share n 
trios of qubits. Notice that there is no need to assume an i.i.d. 
(independent identical distribution) for the n trios. Instead, we 
consider the most general setting where those n trios can be 
fully entangled among themselves and perhaps also with some 
additional ancillas. As noted in the last paragraph, we consider 
only the n-GHZ-basis for the n trios. Each basis vector can be 
denoted by a sequence of n objects each of which takes one of 
the 2 3 = 8 possible values. In fact, following Gottesman-Lo 
[9], we argue that the protocols presented in this paper will 
work well (with high probability) so long as the "type" of 
sequence is known. Recall that, to encode the information 
about the type, we need only consider the relative frequency 
of the eight basis states for the n trios. We can easily 



summarize such information by the marginal density matrix: 

Pabc =diagonal{pooo, Pioo> Poll: Pm, Poio, Pno, Pooi , Pioi}- 
Now the three parties can estimate the eight matrix elements 
of the aforementioned marginal density matrix reliably by 
using local operations and classical communications (LOCCs) 
only. They just measure along X, Y, Z basis and compare the 
results of their local measurements. In fact, they will find that 
the error pattern for the seven non-trivial group elements of 
XXX, ZZI, ZIZ, -YYX, IZZ, -YZY, -XYY, -XYY. 
For example, the error rate for XXX is pioo +£>ioi +P110 + 
Pm, the similar error pattern for other group elements. Since 
these error rates are linearly dependent on p^ and can be 
determined by local operations and classical communications 
(LOCCs), the above equations relate the diagonal matrix ele- 
ment of the density matrix, pabc to experimental observables. 

It should be clear that the above error estimation procedure 
will give accurate information on the type of the sequence. 
Therefore, in what follows, when one studies multi-partite 
entanglement distillation protocol, one can reduce the problem 
of a general initial state of n trios of qubits to the case where 
the n trios are treated as i.i.d. This reduction idea via the 
method of the type is a generalization of the bipartite case 
studied in [9]. Such a reduction technique greatly simplifies 
the problem. 

B. Improved multi-party hashing for distillation of GHZ states 

Suppose M (> 2) parties share an ensemble of n identical 
mixed multi-partite states and they would like to distill out 
almost perfect (generalized) GHZ states. Maneva and Smolin 
[12] found an efficient multi-partite entanglement distillation 
protocol — multi-party hashing method. They used multilateral 
quantum XOR gates (MXOR) as shown in the Fig.4 of [12] 
where every party imposes identical Control-NOT operations 
on some of their own particles from one single source particle 
or to one single target particle. If we write an unknown 
iV-qubit state as an iV-bit string 60,61,62,6^-1 where 6o 
corresponds to the eigenvalue of the operator XX ■ ■ ■ X and 
bi (i > 0) corresponds to the eigenvalue of the operator 
ZiZ i+1 . (See Eq. (3) of [12].) Note that b Q denotes the 
phase error pattern and bi (i > 0) denotes the bit-flip error 
pattern. Maneva and Smolin's protocol involves applying first 
a number of rounds of random hashing in the amplitude bits 
followed by performing a number of rounds of random hashing 
in the phase bit(s). They showed that its yield (per input 
mixed state) was, in the asymptotic large n limit, given by 
Dh = 1 — maXj>o[{H(bj)}] — H(bo), where H(x) is the 
standard Shannon entropy in classical information theory [15]. 
We will argue that, in fact, the yield can be increased to: 

D h = l-max{ff(&i),i/(6 2 |6 1 )}- J ff(6 )+/(6 ;&i,6 2 ), (2) 

for tri-partite case where I(X;Y) is the standard mutual 
information between X and Y. 

The key point is that there may be some correlations 
between bo and (61,62) and also between 61 and 62 i-e-, 
!(&o; 61,62) — 0,I(b\;b2) > If these quantities are non- 



zero, one can improve Maneva-Smolin's protocol by consider 
the following strategy: 

1 The three parties perform nH(bi) rounds of hashing to 
work out the value of &i's completely (Suppose here 
H{b\) < #(62)). Afterwards, the uncertainty in the 
variables 62's is reduced to nH (&2 1 &i ) }■ Therefore, only 
nH (&2 |6i)} rounds of hashing is needed to work out the 
value of 62 's. Note that the hashing of 61 and 62 can 
be simultaneously executed. Therefore, in total, we still 
only need n[max{iJ(6i), H(b2\bi)}] rounds of random 
hashing in amplitude bits. 

2 They use the information on the pattern of 61,62 (the 
amplitude bits) to reduce their ignorance on the pattern 
of 6 (the phase bit) from nH(bo) to nH(b \(bi, 62)) = 
n[H(b ) - I(b ; biM)] = n[H(b , b 1 ,b 2 ) - H(b u b 2 )]- 

3 They apply a random hashing by using multilateral 
quantum XOR gates with regard to one single source 
particle of every party, shown in detail in Fig. 4b of [12] 
to identify the pattern of 60. Now only (slightly more 
than) (60, 61, 62) — #(61,62)] rounds of random 
hashing is needed. 

Thus the yield of our method gives Eq. (0. 

Suppose, one has prepared a class of Werner-like states 
p w = a|$+)($+| + ^1, < a < 1, where |$+) 
denotes the so-called cat state and / is the identity matrix. 
We remark that in the GHZ-basis, the state can be rewritten 
into p w =F|0,00...0) (0, 00 . . . 0| 

+ |0, 00 ... 0) (0, 00 ... 0|). Using the random hash- 

ing method of Maneva and Smolin, for the tri-partite case, we 
can obtain perfect GHZ states with nonzero yield whenever 
F > 0.8075. With our improved random hashing method, we 
still get with nonzero yield whenever F > 0.7554. This is a 
substantial improvement of the original method. 

III. CSS STATES 

In this section, we generalize our results on the GHZ state 
to a general CSS state. We first define a CSS state and show 
that, just like the GHZ state, a CSS state can be distilled by the 
hashing protocol and a recurrence method developed by Murao 
et al in [16]. We derive the yield for the hashing protocol and 
show that a CSS state is equivalent to a bipartite (i.e., two- 
colorable) graph state, a subject of recent attention. 

A. Distillation of CSS-states 

A CSS-state is basically a CSS-code where the number of 
encoded qubit is zero. For instance, an encoded |0) state of a 
CSS code is a CSS-state. More formally, we have the following 
definition. 

CSS states: A CSS-state is a +1 eigenstate of a complete set 
of (commuting) stabilizer generators such that each stabilizer 
element is of X-type or Z-type only. For example, a GHZ- 
state is a CSS-state with stabilizer generators: XXX, ZZI 
and ZIZ. 

Claim 1: Suppose we label its simultaneous eigenstate for 
a CSS-state by its simultaneous eigenvalues \b,p) where 6 = 
{61, 62, • • • , 6 m } is a vector that denotes the tuples of Z-type 



eigenvalues and p — {pi,p2, ■ ■ ■ is a vector that denotes 
the tuples of X-type eigenvalues. Consider a pair of multi- 
partite states under multilateral quantum XOR gates (MXOR), 
the state of the pair evolves as follows: 



MXOR \b 1 ,p 1 )\b 2 ,p 2 ) = {b^p 1 



■p 2 }^ 1 + b 2 ,p 2 



(3) 



Proof: This follows from a standard result in quantum error 
correction. It is easy to understand from the evolution of Pauli 
operators acting on individual qubits. Q.E.D. 

It is easily shown that the yield is: Df ll > 1— max^ [H(pi)]— 



max.- 



H( Pj \b) 



This is so because the mutual information 



I(b,p) between the bit-flip and phase syndrome is non- 
zero. Alternatively, one can hash in X first and then hash 
in Z. Therefore, we also have Dh 2 > 1 — max, 



maxi [if(6j|p)]. Combining the two results, we have Dh > 
max(D hl ,D h2 ). 

We note that one can apply the subroutines PI and P2 in 
[16] to any CSS-state. The PI and P2 steps appeared there 
are, in fact, to apply bit-flip error detection (P2) and phase- 
flip error detection (PI) separately. Here the stabilizer for the 
GHZ state is CSS-like and errors can be corrected by two 
steps together. Allow the successful distillation of CSS-state 
at higher error rates than what is possible with only a hashing 
protocol. 

B. Equivalence of CSS-states and bipartite graph states 

Bipartite graph state: A graph is said to be bipartite (i.e., 
2-colorable) if the set of vertices can be decomposed into two 
sets, say L (left) and R (right) such that an edge is only 
allowed to connect a L vertex with a R vertex (but not between 
two L (or R) vertices). A graph state is a multi-partite state 
where each vertex, Vj, represents a qubit and has stabilizer 
generators of the form Kj = XjlL/j^^Z^. 

Distillation of graph states, have been recently discussed in 
[5] for a special class of bipartite (i.e., 2-colorable). In what 
follows, we will show that they are essentially equivalent to 
CSS-states. 

Claim 2: Bipartite (i.e, two-colorable) graph states are 
equivalent to CSS-states. 

Proof. For details, see our preprint [17] (one part of the 
equivalence: CSS implies bipartite, is due to Eric Rains). 

Claim 2 establishes the equivalence of two different math- 
ematical formulations: CSS-states and bipartite graph states. 
Thus much of what we have learnt about the distillation of 
bipartite/two-colorable graph states through the work of [5] 
can be interpreted in the more systematic language of CSS- 
states. In particular, it is natural to consider the bit-flip and 
phase error patterns separately and consider their propagations 
in quantum computational circuit. From Claim 2, we learn 
that Claim 1, which originally refers to CSS states, can be 
applied directly to any bipartite graph states. Moreover, the 
improvement that we have found in the last section, in fact, 
applies to bipartite graph states. 



IV. 3 -PARTY CONFERENCE KEY AGREEMENT WITH NOISY 
GHZ STATES 

In this section, We consider a prepare-and-measure confer- 
ence key agreement scheme, where we allow the participants 
to perform only local individual quantum measurements and 
local classical computations and classical communications 
(CCCCs) to obtain the same random string of secret, known 
as a key, which can be useful for securing a conference call 
against eavesdropping attacks. 

How do we prove the security of our protocol against 
an eavesdropper? We start with a CSS-based GHZ state 
distillation protocol and try to convert it to a "prepare and 
measure" protocol. 

The protocol involves two subprotocols. For bit-flip error 
detection (B step), we use the P2 step of Murao et al [16] 
as shown in Fig. We remark that the PI step used in 
[16], is, in fact, a phase error detection step (more precisely, 
subsequent measurement operators applied are conditional to 
phase error syndromes found in earlier measurements) and 
is strictly forbidden in a "prepare-and-measure" protocol [9]. 
Thus for phase error correction (P step), we design a procedure 
borrowing the idea of Gottesman and Lo [9] as shown in 
Fig. but apply it to the multi-partite case. 
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Fig. I. Left a: B step (bit-flip error detection) procedure for conference key 
agreement protocol. Right b: P step (phase-flip error correction) procedure 
for conference key agreement protocol. In a prepare-and-measure protocol 
for conference key agreement, each of Alice, Bob and Charlie simply takes 
the parity (Za + Zg + Zq) mod 2 of their own three particles, which can 
be done locally and no classical communication is needed. 

Our multi-partite B step: Using the language of stabilizer, 
this step can be reformulated by the following transformation 
of the two GHZ-like states 

[(Ml, is), (q, 31,3%)] 

applying BXOR , . . , , . . . . . 

— ► (P®q,ii,i2),(q,n®3i,i2®32), (4) 

where (p, 11,12), (q,ji,32) denote the phase bit and amplitude 
bits for the first and second GHZ-like states. If ix j\ = 
i>2 ® 32 = mod 2, we keep the first GHZ state, otherwise 
discard all the two states. This corresponds to the prescription 
that we keep the first trio iff M A = M B and M A = M c (i.e., 
Alice, Bob and Charlie get the same measurement outcome). 
This step just changes the 8 elements of diagonal entries 
accordingly and can be obtained by straight calculation. 



Our multi-partite P step: This step (shown in Fig. [3?) can 
be reformulated by the following transformation of the three 
GHZ-like states 

[(p,h,i2), (q,ji,h), ( r , h,k 2 )] 

applying 1st BXOR r , .. , , , ■ • \ / i ? \i 

— ► LCP»*i © Ji>*2 © 32), ip®q,3i,32), (r,fci,fc 2 )j 

applying 2nd BXOR 

[(p, h © 3i ®h,i2® 32 © h), (p © q, h,h), (p © r, k u k 2 )] 

(5) 

lfp@q— p@r = 1 mod 2, we apply p — ► p © 1 mod 2, 
otherwise keep the first GHZ-like state invariant. Note that P 
can also be performed locally by each party, which regards 
the circuit as implementing a 3-qubit phase error correction 
code. 

We now argue that the aforementioned entanglement distil- 
lation subprotocol (P step) can be converted to a prepare-and- 
measure protocol. This is in the spirit of [9]. In conference key 
agreement, Alice, Bob and Charlie do not need to perform 
phase error correction. They only need to prove that, phase 
error correction would have been successful, if they had 
performed it. Thus in the second part of Fig.^), each of Alice, 
Bob and Charlie simply takes the parity [Za + Zb + Zq) 
mod 2 of their own three particles. No classical communica- 
tion is needed. Moreover, we can apply the same conversion 
idea to any concatenated protocols involving B steps, P steps 
and following by a hashing protocol. This conversion result 
means that we can obtain secure protocols by considering 
the convergence of GHZ distillation protocols involving those 
operations. 

By direct numerical calculation, we can verify that our 
scheme can distill GHZ state with nonzero yield whenever 
F > 0.3976 by some state-dependent sequence of B and P 
steps, and then change to our random hashing method if it 
works. [Notice that the yield of a recurrence protocol asymp- 
totically goes to zero (see [1]). Therefore, it is advantageous 
to switch to a hashing protocol at some point.] We find that 
a sequence of B and P steps BBBBB for F = 0.3976, which 
is optimal for any sequence with at most 5 steps, our new 
protocol gives dramatic improvement by using 2-way classical 
communications compared with the random hashing method 
of Maneva and Smolin which works only when F > 0.8075. 

V. Quantum sharing of classical secrets in a 

NOISY CHANNEL 

Quantum sharing of classical secrets — has also been in- 
troduced [7]. Here, the goal is to use quantum states to 
share a classical secret between multiple parties and to ensure 
that no eavesdropper can learn useful information by passive 
eavesdropping. Whereas [7] considers only the perfect case, 
here we consider the case where the initial state is imperfect, 
following [18], [19]. 

Phase One: The key point is that the GHZ state is a +1 
eigenstate of XXX, and satisfy a classical constraint Xa + 
Xb+Xc — mod 2. Note that individually, each of Bob and 
Charlie has no information on X A . But, by getting together, 



Bob and Charlie can obtain Xb + Xc mod 2 and, therefore, 
obtain Xa- 

Phase two: Suppose Alice now would like to share a bit 
value, b, with Bob and Charlie. She can broadcast Xa + b. 

Note that, since the final measurement is now done along 
the X-axis, the bit-flip measurements now correspond to mea- 
surements along X. Therefore, for the bit-flip error detection 
code (B' step), we use the same procedure as the PI step of 
Murao et al [16] as shown in Fig. [2^. As for the phase error 
correction (P' step), we design a procedure similar to the idea 
of Gottesman and Lo [9] as shown in Fig. \2)p. Details of our 
protocol can be found in our preprint [17]. 
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Fig. 2. Left a: B' step (bit-flip error detection) procedure for secret sharing. 
Right b: P' step (phase-flip error correction) procedure for secret sharing. In 
a prepare-and-measure protocol for secret sharing, each of Alice, Bob and 
Charlie simply takes the parity (Xa + Xb + Xc) mod 2 of their own 
three particles, which can be done locally and no classical communication is 
needed. 

Similar argument to conference key agreement case holds 
for secret sharing. The three parties only need to ensure that, 
phase error correction (P' step) would have been successful, 
if they had performed it. We verify that our scheme used in 
secret sharing in a noisy channel can distill GHZ state with 
nonzero yield whenever F > 0.5372 by some state-dependent 
sequence of B and P steps and then change to our random 
hashing method if it works. For the optimal sequences within 
5 steps, we find it is (B'B'B'B'B') that just gives F > 0.5372 
followed by hashing method. 

Remark 1: Note that, if one of the parties, say Alice, is 
actually the preparer of the multi-partite state, in a prepare- 
and-measure protocol, she is allowed to pre-measure her sub- 
system. By doing so, she projects an iV-partite entangled state 
into one of the various (TV — l)-partite entangled state. There- 
fore, conference key agreement and secret sharing protocols 
can be implemented with only (N — l)-party entanglement. 

Remark 2: It was claimed in Refs. [18], [19] that a violation 
of Bell inequalities is a criterion for security of secret sharing 
schemes [7] under the assumption of individual attacks by Eve 
and one-way classical post-processing protocols by Alice and 
Bob. Violation of Bell inequalities for N par ticles W erner- 
like state is shown in Ref. [20] to be a > l/\ / 2'- N ~ 1 \ For a 
tripartite system, this gives a > 1/2 and thus F > 9/16 = 
0.5625. This is clearly a higher requirement for the initial 
fidelity of a Werner-like state than that for our two-way prepare 



and measure secret sharing scheme which only requires F > 
0.5372. Thus our two-way protocols are secure even when 
Bell inequalities are not violated. 

Experimental Implementations. From Remark 1, for the 
three-party case, our protocols can be done with only bi-partite 
entangled states and can be experimentally implemented with, 
for example, parametric down conversion sources. More con- 
cretely, imagine that Alice prepares a perfect GHZ state 
and measures her qubit along the X, Y, Z-axis. After her 
measurement, Bob and Charlie's state will be -4=(|00) + |11)) 
^(|00) - |11)); ^(|00) + i|ll)) or ^(|00) - i|ll)); 



1 00) or |11) (with equal probabilities) separately. Thus Alice 
could implement the two protocols by simply preparing one of 
the six states, and sending the two qubits to Bob and Charlie 
respectively through some quantum channels. 

We remark that our protocols are not proven to be opti- 
mal. In future, it will be interesting to search for protocols 
with better yields and higher threshold error rates. Moreover, 
one may try to generalize our results to quantum sharing 
of classical secrets for more general access structures. Our 
results will shed some light on the fundamental questions of 
the classification of multi-party entanglement, the power and 
limitations of multi-party quantum cryptography. The details 
of our work can be found in [17]. 

We thank helpful discussions with many colleagues and 
financial support from a number of funding agencies. 
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